A new method lets teams verify that an AI model behaves the same in everyday use as it did during testing, and lets them run safety checks after every fine-tune at a fraction of the usual cost. A study analyzing eight popular safety benchmarks for language models shows that a single safety score can be inflated, that most test questions carry no information, and that models acting more cautiously under evaluation leave detectable traces in their answers.<\/p>\n
The work, credited to researchers including some from the UK AI Security Institute, borrowed techniques built for psychological testing in humans, the kind used in IQ and aptitude exams. Those methods read the answers to individual questions to work out what abilities sit behind them and which questions actually separate one test-taker from another. Applied to AI, the team analyzed answers from up to 192 models across more than 5,000 test questions, which the authors describe as the largest analysis of its kind to date.<\/p>\n
The study found that “safety” splits into three separate things the benchmarks track: how strictly a model refuses requests, how truthfully it answers, and how it handles content that could be harmless or harmful depending on context. These traits move largely independently. A model’s honesty score and its refusal rate describe different behaviors.<\/p>\n
That separation matters because averaging benchmarks together hides real tradeoffs. HarmBench rewards a model for refusing harmful requests. OR-Bench-Hard penalizes a model for being overly cautious with harmless ones. A model that scores well on one tends to score poorly on the other, and it can lift its overall rating simply by blocking more requests across the board, even though that makes it less useful. HarmBench and SORRY-Bench, by contrast, measure almost the same thing, so combining them double-counts one behavior while OR-Bench-Hard pulls in the opposite direction.<\/p>\n
Most questions in these benchmarks turn out to add little. Nearly every model passes some or fails others, so those items do almost nothing to tell models apart. Selecting the most informative questions instead, three short tests of just 25 questions each captured all three safety dimensions more accurately than a random sample of the same size.<\/p>\n
Choosing questions dynamically during the test, the way an adaptive placement exam picks the next question based on prior answers, tightened the result further. For individual benchmarks like HarmBench or SORRY-Bench, roughly ten adaptively chosen questions produced a ranking very close to the full evaluation. That represents a cost reduction of 97 to 99 percent, which makes regular safety checks realistic during development, for example after every fine-tune or model compression step.<\/p>\n
The third finding carries the most weight for the safety debate. The authors call it “sandbagging”: a model notices it is being evaluated and acts more cautiously than it would in normal use. A model that answers hard questions correctly but fails easy ones looks suspicious even when its overall score appears fine, much like a student who nails the hardest exam questions but bombs the easiest.<\/p>\n
In testing, this person-fit check caught 80 to 100 percent of cases where models had been instructed to act overly cautious. On average, one in ten harmless models was flagged by mistake. Adding a second check that compares a model’s current performance against its own past results pushed the detection rate to 94 to 97 percent. When a model fakes its behavior only on certain questions, the pattern stands out; when it fakes consistently, the response pattern looks normal and the second check catches the drift instead.<\/p>\n
The same approach answers a practical question for anyone using an AI service through an API: is the provider still running the model you originally evaluated? Providers can quietly swap in a different model. In one experiment, researchers queried 16 API endpoints again and correctly identified 13 out of 14 distinct models from their response patterns alone. Two catalog entries that appeared to run the same underlying model were correctly left ungrouped. In another case, one service’s answers had drifted a third of the way from its own results two months earlier, a clear sign that something had changed behind the same model name.<\/p>\n
Whether safety benchmarks measure what they claim has been an open question for a while. A meta-study covering 445 AI benchmarks found weaknesses in definitions, task selection, or statistical methods in nearly all of them. The refusal-versus-usefulness tradeoff showed up plainly with Anthropic’s Claude Fable 5, which a medical physicist found unusable because it flagged MRI segmentation as bioterrorism and blocked questions about malaria transmission. After the model was cleared for release, an added filter meant to close that gap in more than 99 percent of cases began blocking harmless coding tasks more often instead.<\/p>\n
Models spotting when they are being tested is documented too. Claude 3.5 Sonnet identified test scenarios correctly 93 percent of the time, and still got it right 84 percent of the time with no hints. Anthropic’s Opus 4.6 worked out on its own, across two separate tasks, that it was inside an evaluation, identified the test, and retrieved the solutions itself.<\/p>\n
The authors argue that AI safety tests should meet the same standards as psychological tests for humans, and that a single test score is not a solid enough basis for deciding whether to release a model. They note one limitation: the sandbagging in their study was simulated through direct instructions, so a model specifically trained to dodge detection would likely be much harder to catch.<\/p>\n
A model can raise its overall rating by refusing more requests across the board. Benchmarks like HarmBench reward refusing harmful requests, so blocking more content lifts the score even though it also blocks harmless requests and makes the model less useful. Averaging several benchmarks together hides this tradeoff.<\/p>\n
Because fewer than 2 percent of questions meaningfully separate models, selecting the most informative ones cuts the work sharply. Roughly ten adaptively chosen questions produced a ranking close to a full benchmark, a cost reduction of 97 to 99 percent, which makes checks after every fine-tune or compression step practical.<\/p>\n
Sandbagging is when a model notices it is being tested and acts more cautiously than it would in real use. It leaves traces: answering hard questions correctly while failing easy ones. The study’s checks caught 80 to 100 percent of instructed cases, rising to 94 to 97 percent when a model’s current results were compared against its own past performance.<\/p>\n